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Minutes of Meeting — 8 June 2021 


NRS AUDIT AND RISK COMMITTEE MEETING 


8 June 2021 
MS Teams 


NRS Non-Executive Director 
NRS Non-Executive Director 
NRS Non-Executive Director 


External Auditor — Audit Scotland 
Internal Auditor — Scottish Government 
Internal Auditor - Scottish Government 


Paul Lowe NRS, Chief Executive 
Linda Sinclair NRS, Director of Corporate Services & Accountable officer 


Claire Tinney NRS, Chief Financial Officer 
Lesley Smillie NRS Census Director team (Item 3) 
Gary Stewart NRS Head of IT Security (Item 3) 


Jamie Donald 
Shirley Cameron 


NRS, Business Continuity Lead (Item 4) 
NRS, Head of NRS Business Management, Secretariat 


Observer 


Gemma Barker NRS Business Support Manager 


Apologies: 
Asif Haseeb External Auditor — Audit Scotland 


1. Welcome, Introductions and Declaration of Interests 


1.1. The Chair welcomed everyone to the meeting. Claire Tinney was welcomed 
to her first meeting as the NRS Chief Financial Officer. 


1.2 An apology was noted from Asif Haseeb. There were no new declarations of 
interest. 


2. Minutes and Actions 


2.1 The minutes of 31 March 2021 were accepted. The minutes would be 
published on the NRS Website Governance page. 


2.2 Updates to actions were noted. 
3. Scotland’s Census 2022: Update, Finance and Cyber Security 


3.1 Paul Lowe provided an update on recent programme recruitment activity to 
strengthen the programme team, to fill existing vacancies and provided an overview 
of the recruitment routes available to NRS. For permanent or fixed term resource 
NRS was reliant on SG HR to facilitate recruitment and this route had been impacted 
by issues arising relating to the Covid-19 pandemic, competing recruitment priorities 
and an earlier recruitment freeze by SG HR. NRS had continued to work with SG to 
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explore opportunities to accelerate activity as well as looking at other options to 
obtain suitable resource. 


3.2 Lesley Smillie provided Committee members with an update on the 
programme. The main activity since the last report to ARC was noted as follows: 
e Changes to programme management and governance rolled out. 
e Additional senior resources had been recruited to the programme team. 
e Supplier management had continued with collective working approaches in 
addition to individual engagement. 
e Operational readiness approaches were described with the live operating 
model planning continuing. 
An update on digital first assurance activity was noted. 
An update on progress against the plan was discussed. 


3.3 Claire Tinney provided an update on the programme financial planning 
assumptions and risks. A reported pressure in the programme finance was noted and 
this was reflected in the RAG status for finance risk (Amber/ Red). Mitigating action 
had been identified and was underway to continuously review the financial position. 
Close engagement with SG Finance had been maintained. A revised position was 
expected to be available by the next SG budget review point, Autumn Budget 
Review. 


3.4 Gary Stewart summarised the report on cyber security. Key points highlighted 
included: 
e Anumber of IT health checks were being planned. 
e Engagement was continuing with ONS to learn lessons from the 2021 Census 
in the rest of the UK. 
e Areview of risks was being undertaken in relation to cybercrime and other 
third party risks. 


4. Business Continuity Risk Deep Dive - Linda Sinclair/Jamie Donald 


4.1 Linda Sinclair provided an overview of progress in the implementation of the 
NRS business continuity plan. The global COVID-19 pandemic had seen the 
implementation of the plan, with improvements applied as lessons were identified. 
An improved business continuity governance structure had now been established 
and additional resources to support in relation to policy development, estates and 
customer services was also in place. 


4.2 The Committee noted the update and the assurance the report had provided. 
A future IT disaster recovery deep dive would build on the business continuity 
approaches. 

5. NRS Finance — Claire Tinney 


5.1 Claire Tinney presented the report which asked members to note the 
provisional outturn for 2020/21 and to note the 2021/22 budget position. 


NG Rieter 


= — Scotland Minutes of Meeting — 8 June 2021 


5.2 Acurrent pressure relating to the Census 2022 programme was discussed. It 
was noted that action was underway to review and scrutinise this, including 
underpinning assumptions and ensure effective financial control with the objective of 
concluding the year with a balanced budget 


5.3 An early draft NRS Annual Report and Accounts for 2020/21 was provided 
and members were invited to provide comments. The next steps in the audit plan 
were noted, and subject to Audit Scotland findings, the final copy was planned to be 
presented to the Committee at the meeting on 16 September 2021 for approval. 


6. Scottish Government Internal Audit Reports - Kate Moffat/Lorraine 
Twyford 


Internal Audit Progress Report for Audit and Risk Committee 


6.1 Lorraine Twyford introduced the paper which provided ARC members with an 
update of SG Internal Audit activities since the last meeting on 31 March 2021. 


6.2 It was noted that the plan had been completed and delivered for 2020-2021. 
The plan for 2021-2022 was now being progressed. 


6.3 The Committee noted the report. 


Final Audit Opinion — 2021-2022 


6.4 The annual assurance report was presented to the Committee. The final SG 
Internal Audit opinion was reported as ‘substantial’. Paul Lowe welcomed the opinion 
and noted thanks to the teams in NRS who had contributed to improvements. 
Internal Audit colleagues were also thanked for their approach, which provided an 
effective balance between challenge and a supportive working relationship. The 
Committee praised NRS for the achievement and noted the improvements in the 
overall audit opinion for the year. 


7. External Audit Update on 2020-2021 Audit - Graeme Samson 


7.1 Graeme Samson provided an update to the Committee on the activity of the 
external audit. 


7.2 No interim management report had been issued. Evaluation of controls in 
place following an interim review had established that effective internal controls were 
in place for the key financial systems reviewed. The final audit of accounts was 
planned for late June/ early July with a summary of findings to be reported in annual 
audit report. 


8. Committee Documents — Linda Sinclair 


NRS Governance Report 
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8.1 Linda Sinclair introduced the paper, which provided a summary of activity 
across the NRS internal systems of control. Following a short discussion, the 
Committee noted the contents of the report. 


8.2 |The Committee welcomed the revised report format. Key points discussed 
were as follows: 

e Arisk relating to Digital Economy Act accreditation application was noted. 
Achieving the accreditation would support NRS aspirations relating to data 
sharing. 

e Arisk relating to the impacts of Covid-19 on archival services was noted. 
Throughout the pandemic emergency procedures had been adopted. 
Services were restarting in buildings and plans to extend provision was being 
considered. Engagement with stakeholders was continuing. 


NRS Portfolio report 


8.3 The Committee noted the report, which provided an update on the status of 
current NRS projects and programmes. 


NRS COVID-19 Report 


8.4 |The Committee noted the report which provided an update on the activity and 
planning underway in relation to the pandemic. A suggestion for a report to also be 
made to the NRS Strategic Board was noted. 


NRS Assurance activities update 


8.5 |The Committee noted the report, which provided an update on the status of 
activities since the last report presented to Audit and Risk Committee in March 2021. 


Scotland’s Census Programme Assurance Activities 


8.6 |The Committee noted the report which provided a specific update on the 
programme assurance activity. 


NRS Audit Recommendations Status Report 


8.7 The Committee noted the report. 


9. Draft ARC Annual Report to the NRS Chief Executive, Accountable Officer 
and Strategic Board — Colin Ledlie 


9.1 The Chair presented the draft report to the Committee and invited comments. 
The draft report would be reviewed in line with the assurance reports received from 
internal and external audit and would be submitted for consideration at the next 
meeting. 
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10. Forward Look - Audit and Risk Committee and Executive Management 
Board 


W 
IX 


10.1 The report was included for information and outlined proposed ARC business 
for the next twelve months. 


11. Any other Business 
11.1 No other business was noted 
12. Date of next meeting 


12.1 The next meeting was planned for 16 September 2021. 
END 


